How to make an insurance brokerage AI-native: a playbook

The test is the E&O question. Your E&O carrier asks: show me what your AI told this client about their coverage, what it relied on, and who approved it. An AI-enabled agency searches a producer's sent mail and hopes. An AI-native agency pulls one record: the agent read policy and endorsement records on a given date, drafted the email, and a licensed account manager approved the exact text at 3:12 pm. If you cannot answer in a minute, you are AI-enabled, however many tools you run.

No agency needs to replace its AMS to become AI-native. The AMS stays the record of clients, policies, endorsements and certificates. What is new is agents arriving from several directions: the AMS vendor's, a voice receptionist, a certificate tool, a chatbot someone in service set up. None of those systems sees what agents do across all of them.

Insurance adds a question other sectors do not have: on whose license is the agent working? An agent that drafts a coverage summary for a client is doing work only a licensed person may do, so it has to act for a named, licensed person, with no more access than that person, and the record has to show it. Before an agent sends a certificate or a submission, something has to decide whether it may, for whom, and record the answer.

OrchKernel is built to be that layer. It does not rate, quote, bind or hold policies, and it is not your AMS. It checks each agent action sent through it against the agency's rules and the live record, holds what needs a person, and keeps the log. Actions that bypass it, such as an AMS feature a user runs directly, are governed by that system's own settings. The OrchKernel blueprint maps it control by control.

An agency is paid a commission on premium, plus fees in some states and lines, plus contingent or profit-sharing commissions. Brown & Brown booked $255 million of profit-sharing contingent commissions on $5.9 billion of revenue in 2025[27]. Revenue moves with premium rates, not with the work done.

People are about half of revenue. Compensation and benefits as a share of revenue at public brokers in fiscal 2025 (our arithmetic on filed figures; Gallagher's is its reported brokerage segment):

Small-agency ratios sit in the paid Best Practices Study, so we have not quoted them. Its 2026 update puts pro forma EBITDA margins at 23.2% to 30.7% by revenue band[35]. Agencies are profitable. The pressure is on how many accounts each AM can carry and how many errors reach clients.

The tailwind is fading. Brown & Brown's organic revenue growth fell from 10.4% in 2024 to 2.8% in 2025[27]. Across the Best Practices revenue bands, organic growth fell from 8.7% to 11.3% down to 6.2% to 10.2%, with commercial lines growth slowing in all but one band "due to a continued softening in the P&C rate environment"[35]. Rising rates grew revenue per employee for several years without anyone working harder. As that stops, capacity per person becomes the lever, and Marsh already expects about $400 million a year of savings partly from "process and automation efficiencies"[26].

Most internal hours sit with account managers and CSRs. We found no independent time study of agency service work; every hours figure below comes from a company selling the fix. Use them to decide what to measure, not what to expect.

For scale: about 37,000 independent agencies average 9.9 staff each, up from 8.2 in 2024[32], and the independent channel places 62% of US property and casualty premium and 87.7% of commercial lines premium[36]. Agencies and brokers employed 996,100 people in 2024[38], and the Bureau of Labor Statistics expects sales agent jobs to grow 3% from 2025 to 2035[25].

Every state licenses the people who sell insurance, mostly on the pattern of the NAIC Producer Licensing Model Act: "a person shall not sell, solicit or negotiate insurance … unless the person is licensed for that line of authority"[1]. The definitions decide where an AI agent may work:

Unlicensed staff are exempt only when they take no commission and their work is "executive, administrative, managerial, clerical" and "only indirectly related to the sale, solicitation or negotiation of insurance"[1]. That line, between clerical work and advice, is the most useful design rule for agents in an agency. Reading, extracting, comparing, filling and drafting sit on the clerical side. Telling a client what a policy means sits on the other.

The open question. We found no regulator guidance on whether an AI system that answers a client's coverage question is "negotiating", or whose license covers itTo be confirmed. Until a regulator says otherwise, the safe design treats any client-facing agent that discusses coverage as acting under a named licensed person's authority, with that person approving what it says.

The Big "I" and Future One's 2026 study of 1,376 agencies found 46% using AI, up from 15% two years earlier. The top uses among them: marketing content (49%), coverage form analysis (43%) and contract reviews (35%)[32]. The study's landing page gives 54% instead of 46%, and the difference is not explained[33]. Beyond the policy gap and the 8.29% figure above, the same association's technology group found 68% of agencies planning to use more AI within a year[34]. These are trade association surveys, not government data.

Carriers are further along: 88% of auto insurers and 70% of home insurers use, plan to use or are exploring AI, in NAIC surveys[6].

We list categories and name example vendors from their own material. These are not recommendations, and their figures are their own.

For most agencies, the first agent will arrive inside the AMS. Applied says its technology runs at 9 of the 10 largest US brokers and 76 of the top 100 property and casualty agencies (vendor claim)[44]. When the vendor's agent works inside the system of record, someone still has to answer who approved a change, on whose license, and from which document, and the AMS release notes do not yet say how.

Most AI-native capital went to carriers and MGAs, not to retail brokers. Corgi, a startup insurer that calls itself "an AI-native platform", raised $106 million at a $2.6 billion valuation in May 2026, three weeks after a $160 million round[51]. Tech-led retail brokers exist but are small: Harper, a licensed agency in San Francisco, says it has raised $47 million and serves "6,000+ businesses" (company claims)[50]. Back-office vendors to brokers raised more modest rounds, such as Comulate's $20 million[52].

We found no AI-first retail agency at the scale of the regional brokers. For an established agency, the route is changing how its own service teams work.

Certificates show the whole approach in one workflow. They are high volume, third parties rely on them, and Texas, among other states, says a certificate "is not a policy of insurance and does not amend, extend, or alter the coverage"[16].

The same pattern carries over to endorsement requests (each change matches a request from an authorized contact), submissions (every recipient is on the producer's market list) and proposals (every coverage statement is approved by a licensed person).

Six stages, in the order the risk rises: reading and checking first, then drafts a person approves, then client-facing intake, then narrow autonomy. The order also follows what vendors ship first, which is checking and extraction[41,45]. Timings assume a book of business on Applied, Vertafore, HawkSoft or a similar AMS, and are estimates, not benchmarks. Different offices or books can sit at different stages.

Stage 0 for one book, one account manager's accounts, then Stage 1 on that book, then certificates as the first Stage 2 workflow. Pick a book with a mix of commercial accounts and an AM who wants to try it, and avoid starting in the 60 days before a heavy renewal month such as 1/1 or 7/1.

An agent can gather the facts and draft the action for each of these. A named person makes the call, and the log shows who.

Real cases first. None involved an AI agent in an agency; each shows a weakness an agent would make faster.

These are scenarios, not reported events. Each is what an agent with too much access could do in an agency, and each maps to one of the control points.

Most AI-specific insurance guidance is written for insurers, not agencies. Agencies are reached mostly through older law (licensing, data security, compensation disclosure, certificates, telemarketing) and as a carrier's third party. The recurring requirements: licensed people for advice, accurate statements, specific reasons for adverse decisions, data security with fast notice, vendor oversight, and records.

The NAIC's Model Bulletin on the Use of AI Systems by Insurers (December 2023) expects a written AI program with governance, risk controls and audit, and due diligence and audit rights over third-party AI. As of 1 April 2026 the NAIC lists 24 states and the District of Columbia as having adopted it[7]. Connecticut addressed its version to "All Insurers"[9]; Illinois to "All Insurers and Regulated Entities"[8]. Whether any state applies it to producers directly is to be confirmedTo be confirmed. An agency acting for a carrier (binding authority, an MGA arrangement, program business) may still be asked to support that carrier's AI program and audits.

California's Bulletin 2022-5 reaches agencies directly. Addressed to insurers and licensees, it tells them to "conduct their own due diligence" before using any rating, underwriting or marketing tool and to give "specific reasons for any adverse underwriting decisions"[10]. New York's Circular Letter No. 7 on AI in underwriting is addressed to insurers only[11]. Colorado's SB21-169 bars insurers from models that unfairly discriminate[18]; its SB26-189 covers automated decisions about insurance among others, with duties from 2027, and exempts entities "to the extent the entities comply with other legal obligations"[19]. How it treats producers is to be confirmedTo be confirmed.

Under the NAIC Insurance Information and Privacy Protection Model Act, after an adverse underwriting decision "the insurance institution or agent responsible for the decision" must give the specific reasons in writing or tell the person they can ask for them[4]. The NAIC's state chart, last updated in fall 2021, lists 17 states with the model, including California, Connecticut, Illinois, Massachusetts, New Jersey, North Carolina and Ohio[5]. The current list is to be confirmedTo be confirmed. It matters mostly in personal lines.

The NAIC Insurance Data Security Model Law applies to every "Licensee", producers included: a security program, audit trails, oversight of service providers, notice to the commissioner within 72 hours, and event records kept five years. Licensees with fewer than ten employees are exempt from the program section but not from notice[2]. The NAIC's summer 2026 state chart shows 27 states and Puerto Rico in its model adoption column, Tennessee for portions of the model (our count)[3].

New York's Part 500 covers anyone operating under a license under the Insurance Law, which on its face includes agents and brokers, with a limited exemption for small firms (fewer than 20 employees and contractors, under $7.5 million of revenue in each of the last three years, or under $15 million of assets), which still leaves MFA and 72-hour notice in place. Duties include access limited to what each user's job needs, reviewed yearly; MFA for any individual accessing any information system; notice within 72 hours of a cybersecurity incident; and an annual filing by 15 April[12]. The universal MFA duty had a two-year transition from the November 2023 amendment, so it has applied since November 2025[13]. How DFS applies Part 500 to individual producers is to be confirmed; its FAQ page could not be openedTo be confirmed.

Enforcement has reached the distribution channel, as the GEICO and Travelers case shows[15]. State enforcement of Gramm-Leach-Bliley privacy rules, and HIPAA duties for benefits brokers, are background we have not re-checkedTo be confirmed.

New York's Regulation 194 requires producers to disclose their role and that the insurer may pay them, and on request to give "the nature, amount and source of any compensation"[14]. Other states varyTo be confirmed. A comparison agent that can see commissions makes this harder to defend.

Texas Insurance Code chapter 1811 says a certificate is not a policy and does not alter coverage, may not confer new or additional rights, may not change notice requirements, and must use an approved form[16]. Section 1811.154 adds that a certificate "may not contain a reference to a legal or insurance requirement contained in a contract other than the underlying contract of insurance, including a contract for construction or services"[17]. That rules out the common request to write "as required by contract" on a Texas certificate. Many other states have certificate laws, several modeled on an NCOIL model act; the list of states is to be confirmedTo be confirmed.

AI-generated voices are "artificial" voices under the TCPA, so robocall consent rules apply[20]. The FCC's 2023 "one-to-one consent" rule for lead generation, aimed squarely at insurance lead buying, was vacated by the Eleventh Circuit in January 2025[21]. Prior express written consent for telemarketing robocalls still applies. State telemarketing laws apply in parallel and varyTo be confirmed.

In Murphy v. Kuhn, New York's highest court restated that agents must obtain requested coverage or tell the client they cannot, but have "no continuing duty to advise, guide or direct a client to obtain additional coverage", and found no special relationship on the record. It described exceptional situations that might create a higher duty: the agent is paid for advice apart from the premium; "there was some interaction regarding a question of coverage, with the insured relying on the expertise of the agent"; or a long course of dealing put the agent on notice that its advice was relied on[23]. An AI-written coverage gap analysis sent to a client looks a lot like the second. That is our inference; ask counsel.

American Building Supply v. Petrocelli, covered under when it goes wrong, adds that receiving the policy without complaint does not protect the broker[22]. Gallagher's 10-K lists risks from the use of AI, including E&O[28]. Some insurers have sought regulators' permission to exclude AI-related liability from corporate policies[54]. Whether agency E&O forms have changed is to be confirmedTo be confirmed; ask your carrier.

The EU AI Act treats AI used "for risk assessment and pricing in relation to natural persons in the case of life and health insurance" as high-risk; property and casualty is not listed[39]. A tracker gives 2 December 2027 for Annex III high-risk duties, and 2 August 2026 for telling people they are dealing with AI under Article 50[40]. Both dates should be checked against the Official Journal after the Digital Omnibus amendmentsTo be confirmed. The Insurance Distribution Directive's best-interest duty and the UK FCA's Consumer Duty also apply to AI-assisted advice; not re-checked for this pageTo be confirmed.

These are our recommendations, inferred from the workflow and the rules above, not survey findings. In a ten-person agency several of them are parts of one job.

Small commercial becomes its own desk. Small accounts carry thin commission, and an outsourcing vendor pitches a "5× profitability improvement" on them (vendor claim)[46]. This is the likeliest place for the highest share of agent-handled work, with sampled review.

Consolidators can gain most, if their offices share one AMS. Agency counts fell from about 39,000 to 37,000 between the 2024 and 2026 studies while average staff rose[30,32], and deals continue: Baldwin closed its CAC Group purchase on 1 January 2026[29]. Rules set up once can run in every acquired office whose records look the same.

Commission pressure is a risk to watch, not yet a fact. We found no source showing clients or carriers cutting commissions because agencies use AI.

OrchKernel sits between the agents and the agency's systems, as drawn in the missing layer. Agents connected through it ask before they act; it checks the rules, holds what needs a person, and records what happened.

What it is not. OrchKernel is not an AMS, a rater, a certificate platform or a licensing database. The AMS stays the system of record for clients, policies, endorsements, certificates and accounting. Licenses stay in state records or a licensing service, premium trust controls stay with accounting and the bank, and MFA is set up in each system. Form filings, legal review of wording and regulator notice belong to the agency and its counsel; coverage decisions belong to carriers.

Notes on coverages a client accepted or declined are filed against the account only after the AM accepts them, which feeds the E&O file. Agents from outside vendors, such as one inside your AMS, connect through OrchKernel's governed actions API or MCP gateway, arriving in the current release.

Where an agency needs a control whatever tools it uses, who owns it, what OrchKernel does about it, and what stays in another system. Where OrchKernel does only part of the job, the row says so.

OrchKernel is source-available under the Business Source License and runs on your own servers, so you can read the code that enforces these controls. An agency running it for itself is covered. A consolidator, franchisor or agency network that wants to run one deployment for many separately owned agencies may need a commercial license; talk to us firstTo be confirmed.

Record the baseline in Stage 0, then track the same numbers at each stage. For agency service metrics such as certificate turnaround, policies checked per CSR or book size per account manager, we found no authoritative public benchmark. Some may sit in the paid Best Practices and Reagan Consulting surveys. We have not quoted rules of thumb we could not source.

Sources were read in October 2026, last reviewed October 2026; dates are publication or data dates. Numbers in the text match the citations. Where a source could not be opened, the text says so or marks the point as to be confirmed.